create-openclaw-bot 5.15.4 → 5.16.1

package/README.md

@@ -7,7 +7,7 @@
 *Run one command → open the dashboard → your bot is live. Windows · macOS · Linux · VPS — Docker-powered, auto-installed for you.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.15.4-0EA5E9?style=for-the-badge" alt="Version 5.15.4" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.1-0EA5E9?style=for-the-badge" alt="Version 5.16.1" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,7 +37,7 @@
 
 ---
 
-## 🆕 What's New in v5.15.4
+## 🆕 What's New in v5.16.1
 
 - 🖥️ **"Control PC" — let the bot open Chrome & apps on your machine**: a new toggle on each bot card turns on the ability for the bot to open Chrome or an allow-listed app (TeamViewer, Zalo, …) on the computer running it. **Off by default**, token-gated, allow-list only, desktop-only.
 - 🌐 **Browsing works out of the box on every OS**: the bot drives your real Chrome on a desktop (your logged-in profile, so sites don't flag it) and starts its own headless Chromium on a server — no more "no browser available" just because Chrome wasn't running.

package/README.vi.md

@@ -7,7 +7,7 @@
 *Chạy một lệnh → mở dashboard → bot lên sóng. Windows · macOS · Linux · VPS — chạy trên Docker, tự cài giúp bạn.*
 
 <p align="center">
-  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.15.4-0EA5E9?style=for-the-badge" alt="Version 5.15.4" /></a>
+  <a href="https://github.com/tuanminhhole/openclaw-setup/releases"><img src="https://img.shields.io/badge/RELEASE-v5.16.1-0EA5E9?style=for-the-badge" alt="Version 5.16.1" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup?tab=MIT-1-ov-file"><img src="https://img.shields.io/badge/LICENSE-MIT-success?style=for-the-badge" alt="MIT License" /></a>
   <a href="https://www.npmjs.com/package/create-openclaw-bot"><img src="https://img.shields.io/npm/v/create-openclaw-bot?style=for-the-badge&label=CLI&color=2563EB&logo=npm&logoColor=white" alt="NPM Version" /></a>
   <a href="https://github.com/tuanminhhole/openclaw-setup/stargazers"><img src="https://img.shields.io/github/stars/tuanminhhole/openclaw-setup?style=for-the-badge&color=eab308&logo=github&logoColor=white" alt="GitHub Stars" /></a>
@@ -37,7 +37,7 @@
 
 ---
 
-## 🆕 Có gì mới trong v5.15.4
+## 🆕 Có gì mới trong v5.16.1
 
 - 🖥️ **"Điều khiển máy" — cho bot mở Chrome & ứng dụng trên máy bạn**: nút mới trên thẻ mỗi bot, bật lên là bot mở được Chrome hoặc app trong danh sách cho phép (TeamViewer, Zalo, …) trên máy đang chạy bot. **Mặc định TẮT**, cần token, chỉ giới hạn danh sách bạn khai, chỉ dùng trên máy có màn hình.
 - 🌐 **Duyệt web chạy ngay trên mọi hệ điều hành**: máy để bàn thì bot dùng **Chrome thật** (profile đã đăng nhập, web ít nghi là bot), server thì tự mở Chromium headless — hết cảnh "không có trình duyệt" chỉ vì chưa mở Chrome.

package/dist/server/local-server.js

@@ -15,7 +15,7 @@ function loadSharedModule(modulePath, globalName) {
 }
 const { buildWorkspaceFileMap, buildCronjobSkillMd, buildInfographicGeneratorSkillMd, buildInfographicGeneratorJs } = loadSharedModule('../setup/shared/workspace-gen.js', '__openclawWorkspace');
 const { buildOpenclawJson, buildEnvFileContent, buildExecApprovalsJson, buildZaloConnectChannelConfig } = loadSharedModule('../setup/shared/bot-config-gen.js', '__openclawBotConfig');
-const { buildDockerArtifacts } = loadSharedModule('../setup/shared/docker-gen.js', '__openclawDockerGen');
+const { buildDockerArtifacts, contextDefaultsScript } = loadSharedModule('../setup/shared/docker-gen.js', '__openclawDockerGen');
 const { HOST_UI_PS1, HOST_UI_PS1_VERSION } = loadSharedModule('../setup/shared/host-ui-ps1.js', '__openclawHostUiPs1');
 const { OPENCLAW_NPM_SPEC, NINE_ROUTER_NPM_SPEC, ZALO_CHANNEL_ID, ZALO_PLUGIN_ID, ZALO_CONNECT_VERSION, ZALO_CONNECT_PLUGIN_SPEC, build9RouterProviderConfig, get9RouterBaseUrl } = loadSharedModule('../setup/shared/common-gen.js', '__openclawCommon');
 const dataExport = loadSharedModule('../setup/data/index.js', '__openclawData');
@@ -646,18 +646,73 @@ function getRealHomedir() {
   return home;
 }
 
+/**
+ * Directories to search when a bare command is not sitting next to the running node.
+ *
+ * resolveBinPath's original assumption — "the CLI lives beside the node that runs me" — holds only
+ * while the Setup UI is launched by the same node that installed openclaw globally. It breaks the
+ * moment the UI runs under the SYSTEM node while openclaw lives in an nvm prefix: `openclaw` stays a
+ * bare name, spawn's own PATH lookup finds nothing either, and every skill/plugin install dies with
+ * `spawn openclaw ENOENT`. Hit on a customer VPS 2026-08-28, right after the UI became a systemd
+ * unit whose PATH carried only the system directories — `openclaw` existed the whole time, at
+ * /root/.nvm/versions/node/v24.20.0/bin/openclaw.
+ *
+ * PATH first (so an operator's own choice still wins), then nvm's per-version bins newest first,
+ * then the usual global npm prefixes. Cached: this runs on every spawn.
+ */
+let extraBinDirsCache = null;
+function extraBinDirs() {
+  if (extraBinDirsCache) return extraBinDirsCache;
+  const dirs = String(process.env.PATH || '').split(process.platform === 'win32' ? ';' : ':').filter(Boolean);
+  const home = os.homedir();
+  const nvmRoot = process.env.NVM_DIR ? join(process.env.NVM_DIR, 'versions', 'node') : join(home, '.nvm', 'versions', 'node');
+  // Newest version first: a box with several nvm nodes almost always installed the CLI under the
+  // latest one, and picking the oldest would run openclaw on a node its engines field rejects.
+  try {
+    for (const v of fs.readdirSync(nvmRoot).sort().reverse()) dirs.push(join(nvmRoot, v, 'bin'));
+  } catch (e) {}
+  for (const d of ['/usr/local/bin', '/usr/bin', '/opt/homebrew/bin', join(home, '.npm-global', 'bin'), join(home, '.local', 'bin')]) dirs.push(d);
+  extraBinDirsCache = dirs;
+  return dirs;
+}
+
 function resolveBinPath(cmd) {
   if (!cmd || cmd.includes('/') || cmd.includes('\\')) return cmd;
+  const names = process.platform === 'win32' ? [`${cmd}.cmd`, `${cmd}.exe`, cmd] : [cmd];
   const nodeBinDir = dirname(process.argv[0]);
-  const localPath = join(nodeBinDir, process.platform === 'win32' ? `${cmd}.cmd` : cmd);
-  if (existsSync(localPath)) return localPath;
-  const localExe = join(nodeBinDir, process.platform === 'win32' ? `${cmd}.exe` : cmd);
-  if (existsSync(localExe)) return localExe;
+  for (const name of names) {
+    const p = join(nodeBinDir, name);
+    if (existsSync(p)) return p;
+  }
   const nodeModulesBin = join(process.cwd(), 'node_modules', '.bin', process.platform === 'win32' ? `${cmd}.cmd` : cmd);
   if (existsSync(nodeModulesBin)) return nodeModulesBin;
+  for (const dir of extraBinDirs()) {
+    for (const name of names) {
+      const p = join(dir, name);
+      if (existsSync(p)) return p;
+    }
+  }
   return cmd;
 }
 
+/**
+ * Child env for a resolved binary, with the binary's own directory on PATH.
+ *
+ * Load-bearing for anything picked out of an nvm prefix: `openclaw` there is a shebang script
+ * (`#!/usr/bin/env node`), so running it by absolute path still resolves `node` from the CHILD's
+ * PATH. Without this the CLI is found and then executed by whatever node happens to be first —
+ * the system one — which is not the node it was installed for.
+ */
+function binEnv(bin, extra = {}) {
+  const env = { ...process.env, ...extra };
+  if (!bin.includes('/') && !bin.includes('\\')) return env;
+  const sep = process.platform === 'win32' ? ';' : ':';
+  const dir = dirname(bin);
+  const cur = String(env.PATH || '').split(sep).filter(Boolean);
+  if (!cur.includes(dir)) env.PATH = [dir, ...cur].join(sep);
+  return env;
+}
+
 // Blacklist of Windows system/large directories that should never be walked
 const SYSTEM_DIR_BLACKLIST = new Set([
   'windows', 'program files', 'program files (x86)', 'programdata',
@@ -704,7 +759,7 @@ function run(cmd, args, opts = {}) {
     const shell = process.platform === 'win32';
     const rawBin = resolveBinPath(cmd);
     const bin = shell && rawBin.includes(' ') && !rawBin.startsWith('"') ? `"${rawBin}"` : rawBin;
-    const child = spawn(bin, args, { cwd: opts.cwd, shell, env: { ...process.env, ...(opts.env || {}) } });
+    const child = spawn(bin, args, { cwd: opts.cwd, shell, env: binEnv(rawBin, opts.env) });
     let stdout = '';
     let resolved = false;
     child.stdout.on('data', (d) => {
@@ -877,7 +932,7 @@ function runStreamed(cmd, args, opts = {}) {
     cwd: opts.cwd,
     shell,
     windowsHide: opts.windowsHide ?? true,
-    env: { ...process.env, ...(opts.env || {}) },
+    env: binEnv(rawBin, opts.env),
   });
   child.stdout.on('data', (d) => sendLog(String(d).trimEnd()));
   child.stderr.on('data', (d) => sendLog(String(d).trimEnd()));
@@ -895,7 +950,7 @@ function runStreamedToLogFile(cmd, args, logFile, opts = {}) {
     cwd: opts.cwd,
     shell,
     windowsHide: opts.windowsHide ?? true,
-    env: { ...process.env, ...(opts.env || {}) },
+    env: binEnv(rawBin, opts.env),
   });
   let offset = 0;
   const poll = setInterval(async () => {
@@ -923,7 +978,7 @@ function runCapture(cmd, args, opts = {}) {
       cwd: opts.cwd,
       shell,
       windowsHide: opts.windowsHide ?? true,
-      env: { ...process.env, ...(opts.env || {}) },
+      env: binEnv(rawBin, opts.env),
     });
     // Some callers need to feed stdin (pbcopy/xclip take the clipboard text that way).
     if (opts.input != null) {
@@ -1605,6 +1660,26 @@ function validateOpenclawConfig(cfg) {
   }
   if (!cfg.channels || typeof cfg.channels !== 'object') throw httpError(500, 'openclaw.json missing channels');
 
+  // Self-healing: two zalo-connect bindings can never share one account — one Zalo number, one
+  // listener. An older edit path hardcoded `accountId: 'default'`, so an edited bot could end up
+  // squatting the first bot's account while its own account sat unbound (no listener, and the
+  // other bot answered in its place). Only repair where the intent is unambiguous: the agent
+  // already has an account of its own provisioned under its agentId.
+  const zaloAccounts = cfg.channels?.['zalo-connect']?.accounts;
+  if (zaloAccounts) {
+    const owner = new Map();
+    for (const binding of cfg.bindings || []) {
+      if (binding.match?.channel !== 'zalo-connect') continue;
+      const accountId = binding.match?.accountId || 'default';
+      const agentId = binding.agentId;
+      if (!owner.has(accountId)) { owner.set(accountId, agentId); continue; }
+      if (owner.get(accountId) === agentId || !zaloAccounts[agentId]) continue;
+      binding.match.accountId = agentId;
+      owner.set(agentId, agentId);
+      sendLog(`[config] Bot "${agentId}" đang dùng chung account Zalo "${accountId}" với "${owner.get(accountId)}" — đã trả về account riêng "${agentId}".`);
+    }
+  }
+
   // Self-healing: Garbage collect any orphaned telegram accounts that are no longer bound to any active agent
   if (cfg.channels?.telegram?.accounts) {
     const boundAccountIds = new Set(
@@ -2012,9 +2087,15 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
   agent.workspace = `/home/node/project/.openclaw/${workspaceDir}`;
   agent.agentDir = `agents/${agentId}/agent`;
 
-  // Find the existing accountId from bindings BEFORE removing them
-  const existingBinding = (cfg.bindings || []).find((b) => b.agentId === agentId && b.match?.channel === 'telegram');
-  const existingAccountId = existingBinding?.match?.accountId || null;
+  // Capture this agent's current accountId per channel BEFORE its bindings are dropped.
+  // The zalo-connect branch below used to hardcode 'default' (and this lookup only covered
+  // telegram), so editing ANY Zalo bot re-pointed it at the FIRST bot's Zalo account: two
+  // bindings claimed `default`, the earlier one won, and the edited bot's own account was left
+  // with no binding at all — so its listener never started and messages were answered by the
+  // other bot. Seen live on a 5-bot install (bot answered under the first bot's name).
+  const previousBindings = (cfg.bindings || []).filter((b) => b.agentId === agentId);
+  const previousAccountId = (ch) => previousBindings.find((b) => b.match?.channel === ch)?.match?.accountId || null;
+  const existingAccountId = previousAccountId('telegram');
   cfg.bindings = (cfg.bindings || []).filter((b) => b.agentId !== agentId);
   if (channel === 'telegram') {
     ensureTelegramChannel(cfg);
@@ -2030,7 +2111,16 @@ async function updateBotInProject(projectDir, agentId, body = {}, runtime = {})
     cfg.bindings.push({ agentId, match: { channel: 'telegram', accountId } });
   } else if (channel === 'zalo-personal') {
     ensureZaloConnectChannel(cfg);
-    cfg.bindings.push({ agentId, match: { channel: 'zalo-connect', accountId: 'default' } });
+    const zc = cfg.channels['zalo-connect'];
+    zc.accounts = zc.accounts || {};
+    // Keep the account this bot already owns; only a bot that never had one falls back to the
+    // create-path rule (first Zalo bot takes `default`, the rest get their own agentId account).
+    // This agent's bindings are already filtered out above, so what remains belongs to others.
+    const otherZaloBindings = cfg.bindings.filter((b) => b.match?.channel === 'zalo-connect').length;
+    const accountId = previousAccountId('zalo-connect') || (otherZaloBindings === 0 ? 'default' : agentId);
+    zc.accounts[accountId] = zc.accounts[accountId] || { enabled: true };
+    zc.defaultAccount = zc.defaultAccount || 'default';
+    cfg.bindings.push({ agentId, match: { channel: 'zalo-connect', accountId } });
   } else if (channel === 'fb-messenger') {
     ensureFbMessengerChannel(cfg, String(body.pageId || '').trim(), String(body.appId || '').trim());
     cfg.bindings.push({ agentId, match: { channel: 'fb-messenger', accountId: 'default' } });
@@ -2640,6 +2730,11 @@ const NATIVE_MARKER = 'native.json';
 // handles coexistence by asking the host what is actually taken, which the fixed offset never did.
 const NATIVE_DEFAULT_GATEWAY_PORT = 18789;
 const NATIVE_DEFAULT_ROUTER_PORT = 20128;
+// The gateway's startup migrations hold a lease on the state directory for FIVE MINUTES, and a boot
+// that collides with it exits immediately instead of waiting. Any health wait shorter than that
+// lease reports failure on a gateway that was always going to come up on its own — the old 180s
+// could not outlast it even in the best case.
+const NATIVE_GATEWAY_HEALTH_TIMEOUT_MS = 420000;
 
 function nativeMarkerPath(projectDir) {
   return join(projectDir || state.projectDir || '', '.openclaw', NATIVE_MARKER);
@@ -2717,13 +2812,22 @@ async function waitForNativeGatewayHealthy(projectDir, timeoutMs = 120000) {
   const port = String(meta.gatewayPort || state.gatewayPort || NATIVE_DEFAULT_GATEWAY_PORT);
   const started = Date.now();
   let attempts = 0;
+  let diagnosed = false;
   while (Date.now() - started < timeoutMs) {
     if (await probeHttpOk(`http://127.0.0.1:${port}/health`, 2500)) return true;
     attempts++;
     if (attempts % 5 === 0) sendLog(`[native] Waiting for gateway on ${port}... (${Math.round((Date.now() - started) / 1000)}s)`);
+    // Half a minute of silence is already abnormal for a gateway that is merely slow, and the two
+    // causes that never resolve on their own (a stolen port, an abandoned unit) look exactly like
+    // "still booting" from here. Say what is wrong once, early, and keep waiting either way.
+    if (attempts === 10 && !diagnosed) {
+      diagnosed = true;
+      await reportNativeGatewayBlockage(projectDir, port).catch(() => {});
+    }
     await new Promise((r) => setTimeout(r, 3000));
   }
   sendLog(`[native] Gateway did not answer /health on ${port} within ${Math.round(timeoutMs / 1000)}s.`);
+  if (!diagnosed) await reportNativeGatewayBlockage(projectDir, port).catch(() => {});
   return false;
 }
 
@@ -2766,7 +2870,33 @@ async function ocDaemon(projectDir, verb, extraArgs = []) {
  * perfectly healthy gateway reports "restart failed" — which used to send callers down a pointless
  * stop+start that raced the migration lease all over again.
  */
+/**
+ * Docker projects replay the idempotent config migrations on every container start — the
+ * entrypoint embeds contextDefaultsScript. Native projects have no entrypoint, so an existing
+ * native bot never received those fixes (a bot created before 5.16.0 kept the smart-route
+ * contextWindow at 200000 and stayed exposed to the compaction deadlock). Replaying the exact
+ * same script here, right before every gateway (re)start, gives native the docker semantics:
+ * migrate first, then boot on the upgraded config.
+ */
+async function runNativeConfigMigrations(projectDir) {
+  const res = await runCapture(process.execPath, ['-e', contextDefaultsScript], {
+    cwd: projectDir,
+    env: nativeEnv(projectDir),
+    shell: false,
+  });
+  if (res.code !== 0) sendLog(`[native] config migrations skipped: ${String(res.stderr || res.stdout || '').trim().slice(0, 200)}`);
+  return res.code === 0;
+}
+
 async function restartNativeRuntime(projectDir) {
+  // Every restart is a chance to repair a project installed before these fixes existed — the
+  // calls are no-ops once the service env is complete, stray files are adopted, and the config
+  // already carries the migrated defaults.
+  await adoptStrayNativeHome(projectDir).catch(() => {});
+  await syncNativeServiceEnv(projectDir).catch(() => {});
+  await runNativeConfigMigrations(projectDir).catch(() => {});
+  await hardenNativeServiceRestarts(projectDir).catch(() => {});
+  await clearNativeServiceFailure(projectDir).catch(() => {});
   const stopStart = async () => {
     await ocDaemon(projectDir, 'stop');
     return ocDaemon(projectDir, 'start');
@@ -2791,14 +2921,111 @@ async function restartNativeRuntime(projectDir) {
     res = await ocDaemon(projectDir, 'restart');
     if (res.code !== 0) res = await stopStart();
   }
-  // systemd keeps restarting a crash-looping unit every RestartSec, so a gateway blocked by a lease
-  // we never saw still comes up on its own — give it room before calling the restart a failure.
-  if (!(await waitForNativeGatewayHealthy(projectDir, 180000))) {
+  // With the start limit lifted (hardenNativeServiceRestarts) systemd really does keep restarting a
+  // crash-looping unit every RestartSec, so a gateway blocked by a lease we never saw still comes up
+  // on its own — give it the full lease window before calling the restart a failure.
+  if (!(await waitForNativeGatewayHealthy(projectDir, NATIVE_GATEWAY_HEALTH_TIMEOUT_MS))) {
     throw new Error('gateway did not answer /health after restart');
   }
   return true;
 }
 
+/**
+ * Make the generated service carry everything nativeEnv() promises.
+ *
+ * `openclaw daemon install` propagates only a fixed allow-list into the service it writes:
+ * OPENCLAW_STATE_DIR survives, but OPENCLAW_HOME does NOT — verified on both a systemd user unit and
+ * a launchd env-wrapper. Anything resolving paths from OPENCLAW_HOME then falls back to `~/.openclaw`
+ * and writes OUTSIDE the project. zalo-connect is the visible casualty: it stages inbound files and
+ * its Zalo session credentials under the wrong home, so a PDF sent to the bot lands somewhere the
+ * agent's workspace cannot reach ("em chưa trích xuất được nội dung từ PDF") and the session sits in
+ * a different home from the config that describes it.
+ *
+ * Idempotent: keys already present are left alone, so this is safe to run on every restart and it
+ * self-heals projects created before the fix.
+ */
+async function syncNativeServiceEnv(projectDir) {
+  if (!isNativeProject(projectDir)) return [];
+  const want = nativeEnv(projectDir);
+  const label = nativeServiceLabel(projectDir);
+
+  if (process.platform === 'linux') {
+    const unit = `${label}.service`;
+    const shown = await runCapture('systemctl', ['--user', 'show', '-p', 'FragmentPath', '--value', unit], { shell: false, timeout: 10000 });
+    const path = String(shown.stdout || '').trim() || join(os.homedir(), '.config', 'systemd', 'user', unit);
+    if (!existsSync(path)) return [];
+    const lines = (await fsp.readFile(path, 'utf8')).split('\n');
+    const have = new Set();
+    for (const line of lines) {
+      const m = line.trim().match(/^Environment="?([A-Z_0-9]+)=/);
+      if (m) have.add(m[1]);
+    }
+    const missing = Object.entries(want).filter(([k, v]) => !have.has(k) && v !== '');
+    if (!missing.length) return [];
+    // Insert after the last existing Environment= line so the additions stay inside [Service].
+    let at = -1;
+    lines.forEach((line, i) => { if (line.startsWith('Environment=')) at = i; });
+    if (at < 0) at = lines.findIndex((line) => line.trim() === '[Service]');
+    if (at < 0) return [];
+    lines.splice(at + 1, 0, ...missing.map(([k, v]) => `Environment=${k}=${v}`));
+    await fsp.copyFile(path, `${path}.bak`).catch(() => {});
+    await fsp.writeFile(path, lines.join('\n'), 'utf8');
+    await run('systemctl', ['--user', 'daemon-reload'], {}).catch(() => {});
+    sendLog(`[native] service env completed: ${missing.map(([k]) => k).join(', ')}`);
+    return missing.map(([k]) => k);
+  }
+
+  if (process.platform === 'darwin') {
+    // launchd runs the gateway through an env-wrapper that sources this file, so patching it is the
+    // launchd equivalent of adding Environment= lines to a unit.
+    const envFile = join(projectDir, '.openclaw', 'service-env', `${label}.env`);
+    if (!existsSync(envFile)) return [];
+    const body = await fsp.readFile(envFile, 'utf8');
+    const have = new Set([...body.matchAll(/^\s*export\s+([A-Z_0-9]+)=/gm)].map((m) => m[1]));
+    const missing = Object.entries(want).filter(([k, v]) => !have.has(k) && v !== '');
+    if (!missing.length) return [];
+    const added = missing.map(([k, v]) => `export ${k}='${String(v).replace(/'/g, "'\\''")}'`).join('\n');
+    await fsp.copyFile(envFile, `${envFile}.bak`).catch(() => {});
+    await fsp.writeFile(envFile, `${body.replace(/\n*$/, '')}\n${added}\n`, 'utf8');
+    sendLog(`[native] service env completed: ${missing.map(([k]) => k).join(', ')}`);
+    return missing.map(([k]) => k);
+  }
+
+  return [];
+}
+
+/**
+ * Reunite a native project with the files an unset OPENCLAW_HOME scattered into `~/.openclaw`.
+ *
+ * This MUST run before syncNativeServiceEnv takes effect: once OPENCLAW_HOME is finally correct, the
+ * plugin looks for its Zalo session inside the project — and if the credentials are still sitting in
+ * the home directory it finds nothing and demands a fresh QR login. Copy (never move) so a failed
+ * run leaves the working original in place; skip anything the project already has.
+ */
+async function adoptStrayNativeHome(projectDir) {
+  if (!isNativeProject(projectDir)) return [];
+  const projectHome = join(projectDir, '.openclaw');
+  const strayHome = join(os.homedir(), '.openclaw');
+  if (resolve(strayHome) === resolve(projectHome) || !existsSync(strayHome)) return [];
+  const moved = [];
+  const entries = await fsp.readdir(strayHome, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    // `state` is deliberately excluded: the project has its own live database and merging two
+    // sqlite files is not something a copy can do correctly.
+    const isCreds = /^zalo-connect-credentials.*\.json$/.test(entry.name);
+    if (!isCreds && entry.name !== 'media') continue;
+    const from = join(strayHome, entry.name);
+    const to = join(projectHome, entry.name);
+    if (existsSync(to)) continue;
+    await fsp.cp(from, to, { recursive: true }).catch(() => {});
+    if (existsSync(to)) moved.push(entry.name);
+  }
+  if (moved.length) {
+    sendLog(`[migrate] Native: adopted ${moved.join(', ')} from ${strayHome} (written there while OPENCLAW_HOME was unset).`);
+  }
+  return moved;
+}
+
 /**
  * `openclaw daemon install` has no `--system` flag, so on Linux the gateway becomes a systemd USER
  * unit — and a user manager without linger is torn down when that user's last session exits. On a
@@ -2824,6 +3051,112 @@ async function ensureSystemdLinger() {
   return false;
 }
 
+/**
+ * Stop systemd abandoning the gateway while the state lease is still held.
+ *
+ * `openclaw daemon install` writes `StartLimitBurst=5` / `StartLimitIntervalSec=60` next to
+ * `Restart=always`. The gateway's startup migrations take a lease on the state directory that lasts
+ * five minutes, and a boot that collides with it exits 1 *immediately* — so five collisions burn the
+ * whole limit in 30 seconds, systemd logs "Start request repeated too quickly", and the unit stays
+ * dead for good even though the lease frees itself minutes later. Verified on a fresh Ubuntu 24.04
+ * VPS (2026-08-28): the setup UI sat on "Waiting for gateway on 18789..." until it timed out, while
+ * `systemctl --user start` afterwards brought the same unit up on the first try.
+ *
+ * A drop-in rather than an edit to the unit body: `daemon install --force` rewrites the unit on every
+ * run, and drop-ins survive that.
+ */
+async function hardenNativeServiceRestarts(projectDir) {
+  if (process.platform !== 'linux' || !isNativeProject(projectDir)) return false;
+  const unit = `${nativeServiceLabel(projectDir)}.service`;
+  const dir = join(os.homedir(), '.config', 'systemd', 'user', `${unit}.d`);
+  const file = join(dir, '99-openclaw-setup.conf');
+  const body = [
+    '# Written by openclaw-setup — regenerated on every install, do not edit.',
+    '# Startup migrations hold the state lease for ~5 minutes and a colliding boot exits at once, so',
+    '# the stock StartLimitBurst=5/StartLimitIntervalSec=60 abandons the unit for good within 30s.',
+    '# No start limit = systemd keeps retrying every RestartSec until the lease frees itself.',
+    '[Unit]',
+    'StartLimitIntervalSec=0',
+    '[Service]',
+    'RestartSec=10',
+    '',
+  ].join('\n');
+  if ((await fsp.readFile(file, 'utf8').catch(() => '')) === body) return true;
+  await fsp.mkdir(dir, { recursive: true });
+  await fsp.writeFile(file, body, 'utf8');
+  await run('systemctl', ['--user', 'daemon-reload'], {}).catch(() => {});
+  sendLog('[native] service hardened: systemd start limit lifted (a migration lease can take 5 min).');
+  return true;
+}
+
+/**
+ * A unit parked at "Start request repeated too quickly" refuses every later `start` until its
+ * failure is cleared — including the one that would finally succeed. Cheap and idempotent, so it
+ * runs before each start and also repairs a project abandoned by an earlier install.
+ */
+async function clearNativeServiceFailure(projectDir) {
+  if (process.platform !== 'linux' || !isNativeProject(projectDir)) return false;
+  const unit = `${nativeServiceLabel(projectDir)}.service`;
+  const shown = await runCapture('systemctl', ['--user', 'show', '-p', 'ActiveState', '--value', unit], { shell: false, timeout: 10000 });
+  if (!/^failed/i.test(String(shown.stdout || '').trim())) return false;
+  await run('systemctl', ['--user', 'reset-failed', unit], {}).catch(() => {});
+  sendLog(`[native] cleared the previous failed state of ${unit} before starting it.`);
+  return true;
+}
+
+/**
+ * Name whatever already owns a port, so a stalled wait can say why it will never end.
+ *
+ * The trap this exists for: an operator runs the port-forward command out of `ssh <host>-setup`
+ * (`ssh -L 18789:127.0.0.1:18789 root@<host>`) while already logged INTO that host instead of from
+ * their own machine. ssh binds 18789 locally and forwards it to 18789 on the same box — a self-loop
+ * that accepts every connection and answers nothing. The gateway can then never bind its port, and
+ * health probes hang instead of failing, so the port looks alive and is useless. Seen on a customer
+ * VPS 2026-08-28. `ss` (iproute2) is used on Linux rather than `lsof`, which a minimal Ubuntu lacks.
+ */
+async function describePortHolder(port) {
+  const trim = (v) => String(v || '').trim();
+  if (process.platform === 'win32') {
+    const out = await runCapture('powershell', ['-NoProfile', '-Command', `$p=(Get-NetTCPConnection -LocalPort ${port} -State Listen -ErrorAction SilentlyContinue | Select-Object -First 1).OwningProcess; if ($p) { "pid $p: " + (Get-Process -Id $p -ErrorAction SilentlyContinue).Path }`], { shell: false, timeout: 15000 });
+    return trim(out.stdout);
+  }
+  if (process.platform === 'linux') {
+    const ss = await runCapture('ss', ['-ltnp'], { shell: false, timeout: 10000 });
+    const line = String(ss.stdout || '').split('\n').find((l) => new RegExp(`[:.]${port}\\s`).test(l)) || '';
+    const pid = (line.match(/pid=(\d+)/) || [])[1];
+    if (!pid) return trim(line);
+    const ps = await runCapture('ps', ['-o', 'args=', '-p', pid], { shell: false, timeout: 10000 });
+    return `pid ${pid}: ${trim(ps.stdout) || trim(line)}`;
+  }
+  const out = await runCapture('lsof', ['-nP', `-iTCP:${port}`, '-sTCP:LISTEN'], { shell: false, timeout: 10000 });
+  return trim(String(out.stdout || '').split('\n')[1]);
+}
+
+/**
+ * Explain a gateway that is not answering, instead of counting down in silence.
+ *
+ * Three causes, all indistinguishable from "still booting" without this: an ssh port-forward
+ * self-loop holding the port (describePortHolder), the migration lease plus systemd's start limit
+ * leaving the unit dead for good (hardenNativeServiceRestarts), or an ordinary crash on boot — for
+ * which the unit's own journal is the only thing that ever says so.
+ */
+async function reportNativeGatewayBlockage(projectDir, port) {
+  const holder = await describePortHolder(port).catch(() => '');
+  if (holder) {
+    sendLog(`[native] Port ${port} is already held by → ${holder}`);
+    if (/(^|\/|\s)ssh(\s|$)/.test(holder) && new RegExp(`-L\\s*\\d*:?${port}:`).test(holder)) {
+      sendLog(`[native] That is an SSH port-forward, not the gateway. \`ssh -L ${port}:...\` belongs on YOUR OWN machine — run it on the server and it steals port ${port} from the gateway and answers nothing. Kill that ssh process on the server, then start the gateway again.`);
+    }
+  }
+  if (process.platform !== 'linux' || !isNativeProject(projectDir)) return;
+  const unit = `${nativeServiceLabel(projectDir)}.service`;
+  const st = await runCapture('systemctl', ['--user', 'show', '-p', 'ActiveState', '-p', 'SubState', '-p', 'NRestarts', '--value', unit], { shell: false, timeout: 10000 }).catch(() => ({}));
+  const vals = String(st.stdout || '').split('\n').map((v) => v.trim()).filter(Boolean);
+  if (vals.length) sendLog(`[native] ${unit} → ${vals.join(' / ')}`);
+  const log = await runCapture('journalctl', ['--user', '-u', unit, '-n', '15', '--no-pager'], { shell: false, timeout: 15000 }).catch(() => ({}));
+  for (const line of String(log.stdout || '').split('\n').map((l) => l.trimEnd()).filter(Boolean)) sendLog(`[native] ${line}`);
+}
+
 /**
  * Native counterpart of the docker entrypoint's `ensure_plugin` (docker-gen.js).
  *
@@ -2836,6 +3169,16 @@ async function ensureSystemdLinger() {
  */
 async function ensureNativePlugins(projectDir, { restart = false } = {}) {
   if (!isNativeProject(projectDir)) return [];
+  // Same cleanup the container entrypoint does (docker-gen.js): an interrupted `plugins install`
+  // leaves extensions/.openclaw-install-stage-XXXXXX behind, and it still carries a plugin manifest —
+  // so the gateway logs "duplicate plugin id detected" every boot and a stale build competes with the
+  // real one for the same id. Native has no entrypoint, so it has to happen here.
+  const extRoot = join(projectDir, '.openclaw', 'extensions');
+  for (const entry of await fsp.readdir(extRoot, { withFileTypes: true }).catch(() => [])) {
+    if (!entry.isDirectory() || !entry.name.startsWith('.openclaw-install-stage-')) continue;
+    await fsp.rm(join(extRoot, entry.name), { recursive: true, force: true }).catch(() => {});
+    sendLog(`[native] removed abandoned plugin staging dir ${entry.name}`);
+  }
   let cfg = {};
   try { cfg = JSON.parse(await fsp.readFile(join(projectDir, '.openclaw', 'openclaw.json'), 'utf8')); } catch {}
   // learning-memory backs plugins.slots.contextEngine for every bot; zalo-connect only when a bot
@@ -2873,7 +3216,7 @@ function startDetached(cmd, args, opts = {}) {
     detached: true,
     stdio: 'ignore',
     windowsHide: opts.windowsHide ?? true,
-    env: { ...process.env, ...(opts.env || {}) },
+    env: binEnv(rawBin, opts.env),
   });
   child.on('error', (err) => sendLog(`[native] Failed to start "${cmd}": ${err.message}`));
   child.unref();
@@ -2967,15 +3310,38 @@ async function startNativeRuntime({ projectDir, osChoice = '', gatewayPort, rout
   // straight away, needs no follow-up restart, and prints no "plugin not found" warnings.
   await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin bootstrap skipped: ${e.message}`));
 
+  // Config migrations BEFORE the first boot too — same ordering the container entrypoint uses
+  // (migrate, then start), so an adopted pre-existing project boots on the upgraded config.
+  await runNativeConfigMigrations(projectDir).catch(() => {});
+
   // Managed service = auto-restart (KeepAlive/Restart=always) and start-at-login, the native
   // equivalent of docker's `restart: always`. --force so re-running install updates the port.
   const env = nativeEnv(projectDir);
   await ensureSystemdLinger();
   await run('openclaw', ['daemon', 'install', '--force', '--port', String(gwPort)], { cwd: projectDir, env });
-  await run('openclaw', ['daemon', 'start'], { cwd: projectDir, env });
-  // Let the first boot finish its state migrations here, while nothing else is competing for the
-  // lease. Every later action (create bot, install plugin) then restarts a settled gateway.
-  await waitForNativeGatewayHealthy(projectDir, 180000);
+  await hardenNativeServiceRestarts(projectDir).catch((e) => sendLog(`[native] service hardening skipped: ${e.message}`));
+  await clearNativeServiceFailure(projectDir).catch(() => {});
+  // `daemon install` already STARTED the unit, and that first boot begins the state migrations that
+  // hold a five-minute lease on the state directory. This used to restart it right away — to pick up
+  // the env completed below — and the restart landed mid-migration: the lease was left behind, every
+  // following boot exited 1 until it expired, and systemd's start limit abandoned the unit long
+  // before that. The setup UI then waited out its whole timeout on a service that was never coming
+  // back (real Ubuntu 24.04 VPS, 2026-08-28). So let this boot finish UNDISTURBED first, and only
+  // then repair the env and restart a settled gateway.
+  const firstBootOk = await waitForNativeGatewayHealthy(projectDir, NATIVE_GATEWAY_HEALTH_TIMEOUT_MS);
+  // Order is load-bearing: adopt the stray files FIRST, then complete the service env. The other way
+  // round, the gateway boots with a corrected OPENCLAW_HOME, finds no Zalo session there, and asks
+  // for a new QR scan even though a perfectly good session exists in the home directory.
+  await adoptStrayNativeHome(projectDir).catch((e) => sendLog(`[migrate] stray home skipped: ${e.message}`));
+  const envAdded = await syncNativeServiceEnv(projectDir).catch((e) => { sendLog(`[native] service env sync skipped: ${e.message}`); return []; });
+  // One restart, and only when there is something to gain by it: a completed env to load, or a first
+  // boot that never answered (in which case the restart is the repair attempt).
+  if (envAdded.length || !firstBootOk) {
+    sendLog(envAdded.length
+      ? '[native] restarting gateway to load the completed service env'
+      : '[native] first boot never answered /health — restarting once to recover');
+    await restartNativeRuntime(projectDir).catch((e) => sendLog(`[native] restart after install: ${e.message}`));
+  }
   sendLog(`[native] gateway service "${label}" running on 127.0.0.1:${gwPort}, 9router on 127.0.0.1:${rtPort}`);
   return { gatewayPort: gwPort, routerPort: rtPort, label };
 }
@@ -3128,7 +3494,7 @@ async function recreateDockerBot(projectDir) {
     // under a state lease, a restart mid-migration exits 1, and systemd's start limit can then
     // abandon the unit. This is the same trap the docker path avoids by waiting for the container
     // before touching it (see startZaloConnectLogin) — wait for /health first.
-    await waitForNativeGatewayHealthy(projectDir, 180000);
+    await waitForNativeGatewayHealthy(projectDir, NATIVE_GATEWAY_HEALTH_TIMEOUT_MS);
     // The bot that was just created/edited may have added the Zalo channel or the context engine to
     // openclaw.json; put those plugins on disk now so this one reload loads them too.
     await ensureNativePlugins(projectDir).catch((e) => sendLog(`[native] plugin ensure skipped: ${e.message}`));
@@ -6628,11 +6994,57 @@ async function printRemoteAccessHint(uiPort) {
   console.log(`   ssh ${fwd} ${sshUserName()}@${ip}`);
   console.log(`   then open:  http://localhost:${uiPort}`);
   console.log(`   (forwards ${ports.length} live port${ports.length > 1 ? 's' : ''}: ${ports.join(', ')})`);
+  // Spelled out because the obvious mistake is to paste that line into the shell it was printed in.
+  // Run there, ssh binds every one of those ports on THIS box and forwards them straight back to
+  // itself: the gateway can no longer bind 18789, and the self-loop accepts connections while
+  // answering nothing, so the port looks alive and the whole install hangs on "Waiting for gateway".
+  // Cost a customer VPS install on 2026-08-28.
+  console.log('   ⚠️  Run that line on YOUR OWN machine — NOT in this shell. On the server it');
+  console.log(`      steals port ${ports.join('/')} from the bot and the install never finishes.`);
   console.log('');
 }
 
+/** True when whatever answers on host:port already looks like an OpenClaw Setup UI. */
+async function detectExistingSetupUi(host, port) {
+  try {
+    const res = await fetch(`http://${host}:${port}/`, { signal: AbortSignal.timeout(2500) });
+    if (!res.ok) return false;
+    const body = (await res.text()).slice(0, 65536);
+    return /openclaw/i.test(body);
+  } catch (_) {
+    return false;
+  }
+}
+
 export async function startLocalInstaller({ host = '127.0.0.1', preferredPort = 51789, openBrowser = true, projectDir = process.cwd() } = {}) {
   const port = await findPort(host, preferredPort);
+  if (port !== preferredPort && (await detectExistingSetupUi(host, preferredPort))) {
+    // Another Setup UI already owns the preferred port (a systemd service, an earlier npx run…).
+    // Hopping to :51790 here is exactly how operators end up with SSH tunnels and printed hints
+    // pointing at a port nothing serves — so reuse the running instance instead of starting a
+    // second one, and keep this process alive so an `ssh -L … "npx create-openclaw-bot"`
+    // one-liner still holds the tunnel open. If the other instance ever goes away, take the
+    // port over so the URL keeps working without the operator re-running anything.
+    const url = `http://${host}:${preferredPort}`;
+    activeUiHost = host;
+    activeUiPort = preferredPort;
+    activeUiProjectDir = projectDir;
+    console.log(`OpenClaw Setup UI is already running: ${url}`);
+    console.log('Reusing the running instance — nothing new was started. Keep this window open if it holds your SSH tunnel.');
+    ensureReopenShortcut();
+    if (openBrowser) openUrl(url);
+    printRemoteAccessHint(preferredPort).catch(() => {});
+    const takeover = setInterval(async () => {
+      if ((await findPort(host, preferredPort)) !== preferredPort) return; // still busy
+      clearInterval(takeover);
+      console.log(`Port ${preferredPort} freed up — starting a Setup UI there to keep ${url} working.`);
+      startLocalInstaller({ host, preferredPort, openBrowser: false, projectDir }).catch(() => {});
+    }, 5000);
+    return;
+  }
+  if (port !== preferredPort) {
+    console.log(`⚠ Port ${preferredPort} is busy with something that is not a Setup UI — using ${port} instead.`);
+  }
   activeUiHost = host;
   activeUiPort = port;
   activeUiProjectDir = projectDir;
@@ -6658,4 +7070,4 @@ export async function startLocalInstaller({ host = '127.0.0.1', preferredPort =
   ]).catch(() => {});
 }
 
-export { patchBrowserAutomationHostPreference, debugChromeProfileDir, defaultChromeProfileDir, createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot, removeEmptyWorkspaceAttestations, runHostCommand, detectHostCommands, detectHostCapabilityCommands, grantHostCapabilities, detectCodexApp, detectCodexMarketplace, resolveCodexCli, openPrivacyPane, projectDeployMode, isNativeProject, nativeServiceLabel, nativeEnv, ocArgv, migrateNativePaths, discoverNativeProjectRoots, detectOs, stripCliWarnings, migrationLeaseDeadline, ensureNativePlugins, findFreeHostPort };
+export { patchBrowserAutomationHostPreference, debugChromeProfileDir, defaultChromeProfileDir, createBotInProject, updateBotInProject, deleteBotInProject, validateOpenclawConfig, startZaloLogin, readBotCredentials, resolveProject9RouterApiKey, installCore, deleteProjectFolder, buildZaloHealthSnapshot, removeEmptyWorkspaceAttestations, runHostCommand, detectHostCommands, detectHostCapabilityCommands, grantHostCapabilities, detectCodexApp, detectCodexMarketplace, resolveCodexCli, openPrivacyPane, projectDeployMode, isNativeProject, nativeServiceLabel, nativeEnv, ocArgv, migrateNativePaths, discoverNativeProjectRoots, detectOs, stripCliWarnings, migrationLeaseDeadline, ensureNativePlugins, findFreeHostPort, syncNativeServiceEnv, adoptStrayNativeHome, runNativeConfigMigrations, detectExistingSetupUi, hardenNativeServiceRestarts, clearNativeServiceFailure, describePortHolder, reportNativeGatewayBlockage };

package/dist/setup/shared/common-gen.js

@@ -1,6 +1,11 @@
 // @ts-nocheck
 (function (root) {
-  const OPENCLAW_NPM_SPEC = 'openclaw@latest';
+  // GHIM version, khong dung @latest: Dockerfile sinh ra mang spec nay, nen "@latest" nghia la
+  // MOI lan rebuild image co the nhay han mot the he openclaw — schema config doi, state DB doi
+  // migration, va bot khach chet ngay sau mot lan bam rebuild vo hai (ca that 103.98.149.154,
+  // 31/08/2026: rebuild keo 2026.7.1-2 → 2026.8.1, gateway tu choi boot, 66 lan restart).
+  // Nang version = doi spec nay MOT CACH CO Y trong mot ban phat hanh setup, kem kiem chung.
+  const OPENCLAW_NPM_SPEC = 'openclaw@2026.8.1';
   const OPENCLAW_RUNTIME_PACKAGES = 'grammy @grammyjs/runner @grammyjs/transformer-throttler @buape/carbon @larksuiteoapi/node-sdk @slack/web-api';
   const NINE_ROUTER_NPM_SPEC = '9router@latest';
   const NINE_ROUTER_PORT = 20128;
@@ -268,7 +273,14 @@ If setup reported a plugin install error, run this after the bot is running:
         {
           id: 'smart-route',
           name: 'Smart Proxy (Auto Route)',
-          contextWindow: 200000,
+          // 1M (Kent chot 01/09/2026) — dao lai quyet dinh 131072 cua 5.16.0. Boi canh de doc
+          // lai sau: 131072 sinh ra vi smart-route fan-out sang upstream free ma model nho nhat
+          // trong pool tran ~128k; khai 200k lam phien day den muc chinh loi goi compaction cung
+          // overflow ("auto-compaction could not recover" cho den /new). Gio pool upstream da la
+          // cac model cua so lon nen khai 1M de phien dai khong bi compaction som. TRADE-OFF: neu
+          // mot combo van con model 128k thi phien vuot 128k se chet dung nhu hoi 5.15.x — do la
+          // van de cua combo, sua bang cach chon model, khong sua bang cach ha window o day nua.
+          contextWindow: 1048576,
           maxTokens: 8192,
           input: ['text', 'image'],
         },

package/dist/setup/shared/docker-gen.js

@@ -194,6 +194,21 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     return `node -e \\"const fs=require('fs'),os=require('os'),path=require('path'),p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));const gp=Number(process.env.OPENCLAW_GATEWAY_PORT||process.env.OPENCLAW_PORT)||c.gateway?.port||18789;const a=new Set(['http://localhost:'+gp,'http://127.0.0.1:'+gp,'http://0.0.0.0:'+gp]);for(const entries of Object.values(os.networkInterfaces()||{})){for(const entry of entries||[]){if(!entry||entry.internal||entry.family!=='IPv4'||!entry.address)continue;a.add('http://' + entry.address + ':'+gp);}}const p9=c.models&&c.models.providers&&c.models.providers['9router'];if(p9){p9.request=Object.assign({},p9.request,{allowPrivateNetwork:true});}c.tools=Object.assign({},c.tools,{profile:'full',exec:{host:'gateway',security:'full',ask:'off'}});c.gateway=Object.assign({},c.gateway,{port:gp,bind:'custom',customBindHost:'0.0.0.0',controlUi:Object.assign({},c.gateway?.controlUi,{allowedOrigins:Array.from(a).filter(Boolean)})});fs.writeFileSync(p,JSON.stringify(c,null,2));}\\"`;
   }
 
+  // Idempotent config upgrade replayed on every runtime start. Docker embeds it in the container
+  // entrypoint; the native runtime (local-server.js) runs it via `node -e` before every gateway
+  // (re)start — one script, both deploy modes, so native bots stop missing config fixes like the
+  // smart-route contextWindow 200000/131072 → 1048576 (Kent chot 01/09/2026; chi dung den DUNG
+  // hai gia tri setup tung ghi, custom tuning giu nguyen). Full rationale sits with the
+  // entrypoint block inside buildDockerArtifacts.
+  // ⚠️ toolResultMaxChars: openclaw ≥2026.8 BO key nay khoi schema va TU CHOI BOOT khi thay no.
+  // Ban cu cua script nay them key vo dieu kien moi lan container start — nen mot khach rebuild
+  // image (Dockerfile keo openclaw moi) la roi vao vong: gateway chet vi key ⇒ xoa tay ⇒ entrypoint
+  // them lai ⇒ chet tiep, khong lo ra thu pham (ca that 103.98.149.154, 31/08/2026, 66 lan restart).
+  // Gio gate theo version openclaw THAT trong container: <2026.8 thi backfill nhu cu, ≥2026.8 thi
+  // GO key neu con (tu chua cac project da nhiem). Khong doc duoc version thi KHONG dong nao chay
+  // — tha thieu mot default con hon gieo key lam gateway tu choi boot.
+  const contextDefaultsScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.skills=c.skills||{};c.skills.workshop=c.skills.workshop||{};if(!c.skills.workshop.approvalPolicy){c.skills.workshop.approvalPolicy='auto';ch=true;}if(c.browser&&c.browser.enabled!==false){c.tools=c.tools||{};const dn=Array.isArray(c.tools.deny)?c.tools.deny:[];if(!dn.includes('browser')){dn.push('browser');c.tools.deny=dn;ch=true;}}const d=(c.agents&&c.agents.defaults)?c.agents.defaults:null;if(d){if(d.imageMaxDimensionPx===undefined){d.imageMaxDimensionPx=1024;ch=true;}if(d.imageQuality===undefined){d.imageQuality='efficient';ch=true;}let ocMajorMinor=0;try{const v=String(require('child_process').execSync('openclaw --version',{stdio:['ignore','pipe','ignore']})).match(/(\\d{4})\\.(\\d+)/);if(v)ocMajorMinor=Number(v[1])*100+Number(v[2]);}catch(e){}if(ocMajorMinor&&ocMajorMinor<202608){d.contextLimits=d.contextLimits||{};if(d.contextLimits.toolResultMaxChars===undefined){d.contextLimits.toolResultMaxChars=12000;ch=true;}}else if(d.contextLimits&&d.contextLimits.toolResultMaxChars!==undefined){delete d.contextLimits.toolResultMaxChars;ch=true;}}const pr=c.models&&c.models.providers&&c.models.providers['9router'];if(pr&&Array.isArray(pr.models)){for(const m of pr.models){if(m&&m.id==='smart-route'&&(m.contextWindow===200000||m.contextWindow===131072)){m.contextWindow=1048576;ch=true;}}}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+
   function buildDockerArtifacts(options) {
     const {
       openClawNpmSpec,
@@ -272,8 +287,13 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
     //   • imageMaxDimensionPx / imageQuality / contextLimits.toolResultMaxChars → keep one
     //     heavy turn (deep research, 4K chart read-back) from overflowing the context
     //     window mid tool-loop, which cannot be compacted and poisons the session.
+    //   • smart-route contextWindow 200000 → 131072: the old declared window exceeded the
+    //     smallest upstream in typical free-model combos, so full sessions deadlocked —
+    //     the compaction summarize call itself overflowed and only /new recovered. Only the
+    //     exact setup-written 200000 is rewritten; an operator's custom value is left alone.
     // Each key is only filled in when absent, so an operator's own tuning is never clobbered.
-    const contextDefaultsScript = `const fs=require('fs'),path=require('path');const p=path.join(process.cwd(),'.openclaw','openclaw.json');if(fs.existsSync(p)){const c=JSON.parse(fs.readFileSync(p,'utf8'));let ch=false;c.skills=c.skills||{};c.skills.workshop=c.skills.workshop||{};if(!c.skills.workshop.approvalPolicy){c.skills.workshop.approvalPolicy='auto';ch=true;}if(c.browser&&c.browser.enabled!==false){c.tools=c.tools||{};const dn=Array.isArray(c.tools.deny)?c.tools.deny:[];if(!dn.includes('browser')){dn.push('browser');c.tools.deny=dn;ch=true;}}const d=(c.agents&&c.agents.defaults)?c.agents.defaults:null;if(d){if(d.imageMaxDimensionPx===undefined){d.imageMaxDimensionPx=1024;ch=true;}if(d.imageQuality===undefined){d.imageQuality='efficient';ch=true;}d.contextLimits=d.contextLimits||{};if(d.contextLimits.toolResultMaxChars===undefined){d.contextLimits.toolResultMaxChars=12000;ch=true;}}if(ch)fs.writeFileSync(p,JSON.stringify(c,null,2));}`;
+    // (The script itself lives at module scope — the native runtime replays the exact same
+    // migration before every gateway (re)start, since native projects have no entrypoint.)
     // Companion backfill for the same older projects: their TOOLS.md was generated before the
     // skill-authoring / long-turn guidance existed, and workspace files are only written when a
     // bot is created — so a rebuild alone leaves the assistant stopping at "proposal awaiting
@@ -288,6 +308,17 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       'export OPENCLAW_HOME="${OPENCLAW_HOME:-$PWD/.openclaw}"',
       'export OPENCLAW_STATE_DIR="${OPENCLAW_STATE_DIR:-$OPENCLAW_HOME}"',
       'mkdir -p "$OPENCLAW_HOME" "$OPENCLAW_STATE_DIR"',
+      // `openclaw plugins install` unpacks into extensions/.openclaw-install-stage-XXXXXX and removes
+      // it when it finishes. An interrupted install leaves the staging copy behind — and it still
+      // carries a plugin manifest, so the gateway logs "duplicate plugin id detected" on every boot
+      // and a stale build competes with the real one for the same id. Found on a production host: a
+      // zalo-connect 3.0.7 stage dir shadowing 3.0.17 for a week. Nothing is installing at entrypoint
+      // time, so any stage dir here is by definition abandoned.
+      'for stage in "$OPENCLAW_HOME"/extensions/.openclaw-install-stage-*; do',
+      '  [ -d "$stage" ] || continue',
+      '  echo "[entrypoint] removing abandoned plugin staging dir $(basename "$stage")"',
+      '  rm -rf "$stage"',
+      'done',
       'if [ "$OPENCLAW_STATE_DIR" != "$OPENCLAW_HOME" ]; then',
       '  for path in "$OPENCLAW_HOME"/*; do',
       '    [ -e "$path" ] || continue',
@@ -436,6 +467,24 @@ if(touched){console.log('[patch-9router] Applied Codex compatibility patch.');}e
       // `set -e` is on: a non-zero return here must never stop the gateway from starting.
       'start_local_headless_chrome || true',
     ].join('\n'));
+    // ── Doctor-on-upgrade ─────────────────────────────────────────────────────────────────
+    // Update openclaw khong bao gio chi la "doi so version": schema config doi (key cu bi TU CHOI
+    // chu khong bo qua) va state DB doi migration (audit-events-v2…), va doctor chi chay sach khi
+    // gateway DANG TAT — tuc dung ngay tai day, truoc `gateway run`, trong container vua boot.
+    // So version hien tai voi lan boot truoc (marker trong $OPENCLAW_HOME); khac nhau moi chay,
+    // hai luot vi doctor boc migration theo LOP (ca that 103.98.149.154 can nhieu luot). `yes |`
+    // vi doctor co cau hoi tuong tac; loi doctor khong chan boot — gateway se tu noi not phan con
+    // thieu, con hon container chet cung khong ai chan doan duoc.
+    runtimeParts.push([
+      'OC_VER="$(openclaw --version 2>/dev/null | head -1)"',
+      'OC_VER_MARKER="$OPENCLAW_HOME/.openclaw-last-version"',
+      'if [ -n "$OC_VER" ] && [ "$OC_VER" != "$(cat "$OC_VER_MARKER" 2>/dev/null)" ]; then',
+      '  echo "[entrypoint] openclaw version changed ($(cat "$OC_VER_MARKER" 2>/dev/null || echo none) -> $OC_VER); running doctor --fix"',
+      '  yes | openclaw doctor --fix || true',
+      '  yes | openclaw doctor --fix || true',
+      '  printf %s "$OC_VER" > "$OC_VER_MARKER" || true',
+      'fi',
+    ].join('\n'));
     runtimeParts.push('openclaw gateway run');
     const runtimeScript = ['#!/bin/sh', 'set -e', ...runtimeParts].join('\n');
     let browserInstall = '';
@@ -682,6 +731,7 @@ ${appEnvironmentBlock}${plainSingleExtraHosts ? `${extraHostsBlock}\n` : ''}
     build9RouterComposeEntrypointScript,
     buildGatewayPatchCmd,
     buildDockerArtifacts,
+    contextDefaultsScript,
   };
 
 })(typeof globalThis !== 'undefined' ? globalThis : {});

package/dist/web/app.js

@@ -413,7 +413,11 @@ function remoteAccessPanel(s = {}) {
   const host = r.host || '<your-server-ip>';
   const user = r.user || 'root';
   const portOf = (raw, def) => { try { return new URL(raw).port || def; } catch { return def; } };
-  const ports = Array.from(new Set([r.uiPort || 51789, portOf(s.gatewayUrl, 18789), portOf(s.routerUrl, 20128), 18790]));
+  // zalo-mod's dashboard is gateway port + 1, not a fixed 18790 — the same rule the plugin card's
+  // "Open" button uses. Hardcoding it meant any project whose gateway is not on 18789 got a tunnel
+  // command missing the dashboard port, and the dashboard then simply failed to load with no clue why.
+  const gwPort = Number(portOf(s.gatewayUrl, 18789));
+  const ports = Array.from(new Set([r.uiPort || 51789, gwPort, Number(portOf(s.routerUrl, 20128)), gwPort + 1]));
   const cmd = `ssh ${ports.map((p) => `-L ${p}:127.0.0.1:${p}`).join(' ')} ${user}@${host}`;
   return `<details class="card" style="margin-top:12px;" ${r.headless ? 'open' : ''}>
     <summary style="cursor:pointer; font-weight:600;">🌐 ${t('Mở từ máy khác (VPS/server)', 'Open from another machine (VPS/server)')}</summary>
@@ -1011,11 +1015,7 @@ function botListPanel(bots) {
   const listItems = bots.map(b => {
     const role = (b.role || b.desc || b.description || '').trim() || t('Tr\u1ee3 l\u00fd OpenClaw','OpenClaw assistant');
     const isZalo = b.channel === 'zalo-personal';
-    const health = isZalo ? zaloAccountHealth(b) : null;
-    const connection = !health ? t('Chưa rõ','Unknown') : health.running ? t('Đã kết nối','Connected') : health.lastError ? t('Mất kết nối','Disconnected') : t('Đang kết nối','Connecting');
-    const login = !health ? t('Chưa rõ','Unknown') : health.sessionSaved ? t('Đã đăng nhập','Logged in') : t('Chưa đăng nhập','Not logged in');
-    const connectionTone = health?.running ? 'ok' : health?.lastError ? 'bad' : 'warn';
-    const loginTone = health?.sessionSaved ? 'ok' : health ? 'bad' : 'warn';
+    const { connection, login, connectionTone, loginTone } = zaloHealthBadges(b);
     return `<article class="bot-item ${state.activeBotId===b.id?'active':''}" data-bot-id="${escapeHtml(b.id)}"><div class="bot-item-actions"><button class="bot-edit" data-edit-bot="${escapeHtml(b.id)}" title="${t('Sửa bot','Edit bot')}" aria-label="${t('Sửa bot','Edit bot')}">${actionIcon('edit')}</button><button class="bot-delete" data-delete-bot="${escapeHtml(b.id)}" title="${t('X\u00f3a bot','Delete bot')}" aria-label="${t('X\u00f3a bot','Delete bot')}">&times;</button></div><div class="bot-item-title"><b>${escapeHtml(b.name)}</b></div><small title="${escapeHtml(role)}">${escapeHtml(role)}</small>${isZalo ? `<div class="zalo-bot-health"><div><span>${t('Kết nối','Connection')}</span><em class="${connectionTone}">${connection}</em></div><div><span>${t('Đăng nhập','Login')}</span><em class="${loginTone}">${login}</em></div></div>` : ''}</article>`;
   });
   listItems.push(`
@@ -1623,7 +1623,10 @@ document.querySelectorAll('[data-project-pick-folder]').forEach(btn => btn.oncli
     body.projectDir = activeProjectDir();
     body.channel = state.botChannel || 'telegram';
     body.userTimezone = state.tz;
-    if (body.channel === 'zalo-personal') {
+    // Only the CREATE flow starts a Zalo QR login (the server kicks it off and sets
+    // loginStarted). Editing a bot (rename, persona...) must never pop the QR modal —
+    // the session is already saved and the PUT endpoint starts no login.
+    if (body.channel === 'zalo-personal' && !state.botEditId) {
       state.botModalOpen = false;
       state.zaloLoginOpen = true;
       state.zaloQrDataUrl = '';
@@ -1718,6 +1721,24 @@ function zaloAccountHealth(bot) {
     || accounts.find((account) => account.accountId === (bot?.accountId || 'default'))
     || null;
 }
+// Connection/login labels for one bot. lastError wins over running: the gateway keeps
+// running=true while the Zalo listener is stuck in a retry loop (e.g. "Đăng nhập thất
+// bại"), so a running-first check painted dead bots green.
+function zaloHealthBadges(bot) {
+  const health = bot?.channel === 'zalo-personal' ? zaloAccountHealth(bot) : null;
+  const loginFailed = !!health?.lastError && /đăng nhập|log ?in|auth|credential|session/i.test(String(health.lastError));
+  const connection = !health ? t('Chưa rõ','Unknown')
+    : health.lastError ? t('Mất kết nối','Disconnected')
+    : health.running ? t('Đã kết nối','Connected')
+    : t('Đang kết nối','Connecting');
+  const login = !health ? t('Chưa rõ','Unknown')
+    : loginFailed ? t('Phiên hết hạn','Session expired')
+    : health.sessionSaved ? t('Đã đăng nhập','Logged in')
+    : t('Chưa đăng nhập','Not logged in');
+  const connectionTone = !health ? 'warn' : health.lastError ? 'bad' : health.running ? 'ok' : 'warn';
+  const loginTone = !health ? 'warn' : loginFailed ? 'bad' : health.sessionSaved ? 'ok' : 'bad';
+  return { health, connection, login, connectionTone, loginTone };
+}
 function zaloToolbar(channelBots = []) {
   const active = channelBots.find((bot) => bot.id === state.activeBotId) || channelBots[0];
   const health = zaloAccountHealth(active);
@@ -1729,6 +1750,42 @@ async function loadZaloHealth(silent=false){
   try { state.zaloHealth = await api('/api/zalo/health' + projectQuery()); } catch (_) { state.zaloHealth = null; }
   if (!silent) render();
 }
+// Patch the connection/login badges of the rendered bot cards in place. render() rebuilds
+// the whole panel (killing focus/scroll), so the auto-refresh below must never call it.
+function updateZaloHealthDom() {
+  const bots = state.install?.bots || [];
+  document.querySelectorAll('.bot-item[data-bot-id] .zalo-bot-health').forEach((wrap) => {
+    const id = wrap.closest('[data-bot-id]')?.dataset.botId;
+    const bot = bots.find((b) => b.id === id);
+    if (!bot) return;
+    const badges = zaloHealthBadges(bot);
+    const ems = wrap.querySelectorAll('em');
+    if (ems[0]) { ems[0].className = badges.connectionTone; ems[0].textContent = badges.connection; }
+    if (ems[1]) { ems[1].className = badges.loginTone; ems[1].textContent = badges.login; }
+  });
+}
+// Live status: poll the health endpoint while Zalo bots are on screen (the server caches
+// the ~3s CLI probe with a short TTL, so this stays cheap) and patch the badges in place —
+// no more pressing "Làm mới" to see a bot drop or come back.
+const ZALO_HEALTH_POLL_MS = 10000;
+let zaloHealthPollBusy = false;
+// Debounced instant refresh for log-visible state changes (login saved, container
+// restarted...) so the badges flip within ~2s instead of waiting out a poll tick.
+let zaloHealthRefreshTimer = null;
+function scheduleZaloHealthRefresh() {
+  if (zaloHealthRefreshTimer) return;
+  zaloHealthRefreshTimer = setTimeout(async () => {
+    zaloHealthRefreshTimer = null;
+    try { await loadZaloHealth(true); updateZaloHealthDom(); } catch (_) {}
+  }, 1500);
+}
+setInterval(async () => {
+  if (document.hidden || zaloHealthPollBusy) return;
+  if (!activeProjectDir()) return;
+  if (!document.querySelector('.bot-item[data-bot-id] .zalo-bot-health')) return;
+  zaloHealthPollBusy = true;
+  try { await loadZaloHealth(true); updateZaloHealthDom(); } finally { zaloHealthPollBusy = false; }
+}, ZALO_HEALTH_POLL_MS);
 async function loadFeatureFlags(silent=false){
   const botId=currentBotId();
   if (!activeProjectDir()) { state.featureFlags = {}; state.featureInstalled = {}; state.featureVersions = {}; if (!silent) render(); return; }
@@ -1784,6 +1841,7 @@ function appendLogLine(line) {
     });
     return;
   }
+  if (/\[zalo-connect\].*(login saved|listener (connected|start failed)|restarted|login failed|logged out)/i.test(line)) scheduleZaloHealthRefresh();
   const html = `<p>${escapeHtml(line)}</p>`;
   if (state.zaloLoginOpen || /\[zalo-connect\]|zalo|qr|login|scan/i.test(line)) {
     state.zaloLoginLines.push(cleanTerminalLine(line));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-openclaw-bot",
-  "version": "5.15.4",
+  "version": "5.16.1",
   "description": "Interactive CLI installer for OpenClaw Bot",
   "main": "dist/cli.js",
   "bin": {